# Environment Documentation Creatia, as usual, is a hodgepodge of rapid design choices and put in hacks to get shit done - This isn't appropriate to be clear for the longterm, so when you find dirty things please take ownership and fix it when you can IF you can - But anyway, you can see all the main environment information for Creatia that you need to control and manipulate Creatia. It's quite possible there is a few hard-coded things so be aware of that. | Variable | Maps To | Description | - | - | - | | APP_NAME | | Used by Laravel to identify itself as a specific application | | APP_ENV | | Used by Laravel and Creatia automation to identify whether we are operating in production or development. | | APP_KEY | | Used as an encryption key by Laravel itself to ensure a secure application. | | APP_DEBUG | | Used to dump out the reasons for failure by the application. Should be set to false unless you're positive the application is not open to the world, because this can be exploited. | | APP_URL | | Used by Laravel to identify the domain that the application is running on. | | APP_ENTERPRISE | | Used to determine whether the application is an enterprise deployment or not. This will control what routes and automation functions. | | APP_DEMONSTRATION | | Used to determine whether the application is being ran in demonstration mode. | | LOG_CHANNEL | | How logging is split up and managed by Laravel. By default we've been using `Stack`, however it's probably worth moving to daily. | | LOG_DEPRECATIONS_CHANNEL | | Pretty straight-forward - Where we send deprecation warnings. | | LOG_LEVEL | | The minimum level a piece of logging must be before it will be written to a log. | | DB_CONNECTION | | What type of database connection is being used. Creatia by default should use `pgsql` | | DB_HOST | | The host that the database is operating on. | | DB_PORT | | The port that the database is operating on. | | DB_DATABASE | | The database that Creatia is operating on. | | DB_USERNAME | | The user for Creatia to access the database. | | DB_PASSWORD | | The password that Creatia uses to access the database. | | BROADCAST_DRIVER | | Describes the driver we're using to push events to websockets. Presently use Reverb. | | BROADCAST_CONNECTION | | The connection we're using to push events to websockets. Presently use Reverb. | | CACHE_DRIVER | | Whatever it is that we're storing our cached information in. Ideally this should be something like Redis. | | FILESYSTEM_DRIVER | | Whatever it is that we're storing our files in. Ideally should be filesystem. | | QUEUE_CONNECTION | | What we're using to queue things up / batch them. | | SESSION_DRIVER | | What we're storing session information in. | | SESSION_LIFETIME | | How long sessions will last. | | REDIS_HOST | | Where Redis is hosted. | | REDIS_PASSWORD | | The password for actually accessing Redis. | | REDIS_PORT | | The port that Redis will be accessed on. | | MAIL_MAILER | | What we're using to send mail. | | MAIL_HOST | | Wherever the mailer is being hosted. | | MAIL_PORT | | The port the mailer is being hosted on. | | MAIL_USERNAME | | The username for the mailer. | | MAIL_PASSWORD | | The password to access the mailer. | | MAIL_ENCYRPTION | | The encryption scheme used for the mailer. | | MAIL_FROM_NAME | | Who the sender will be more the messages. | | MAIL_FROM_ADDRESS | | The address messages will be sent from. | | MASTER | | This presently is not used but the idea of it is that this would be a master node, and it does the automation that needs to be only executed in one place. This might be more useful when Creatia is horizontally scaled, though now it seems we're switching to a microservices paradigm. This is a dinosaur of old Mercury -> Creatia design. | | HEADLESS | | Similar to the above, but instead it was purely meant to run a Creatia server without any web accessible functionality. | | JWT_SECRET | | This exists to ensure that the JWT authentication remains cryptographically secure. This should ALWAYS be different for each enterprise deployment. If we horizontally cluster Creatia it should be the same PER cluster. | | DEVELOPMENT_EMAIL_REDIRECT | | The address emails should be redirected to in a development environment if we're not mailing to the logger. | | AWS_ACCESS_KEY_ID | | The AWS key used to identify Creatia to AWS. | | AWS_SECRET_ACCESS_KEY | | The secret key to prove we are authorised to access AWS. | | AWS_DEFAULT_REGION | | The AWS region Creatia is operating in. | | AWS_BUCKET | | The bucket we store things in for AWS. Presently used for Geo IP stuff. | | AWS_USE_PATH_STYLE_ENDPOINT | | Irrelevant, keep false. | | AWS_CLOUDFRONT_DISTRIBUTION_ID | | The CloudFront cache we invalidate when we change the bucket up. | | CHUNK_SIZE | | The size of chunks for automation based DB queries. | | AUTH_PASSWORD_FOR_TOKEN | | Unsure - Potentially deprecated. | | RANDOM_SHA | | Used by Lorenzo's port names automation. Exists to identify his stuff accurately. Should be removed from Creatia or forced to use the correct authentication mechanism to reduce attack surface. | | RADB_ENDPOINT | | The API endpoint we use for RADB | | RADB_USERNAME | | The username for RADB | | RADB_PASSWORD | | The password / API token for RADB | | RADB_CRYPT | | The 'crypt' for RADB - Since they apparently don't understand how to craft a secure API. | | WHMCS_SECRET | creatia.whmcs.secret | Used as a shared secret between WHMCS and Creatia to allow HMAC integrity checks. Disabled at this time in favour of hard white-listing since people kept changing things without ever telling me. | | CLICKHOUSE_ENDPOINT | creatia.clickhouse.endpoint | Consider refactoring this to use the database configuration. This is so we can hit telemetry. | | CLICKHOUSE_PORT | | Should be fairly self explanatory. | | CLICKHOUSE_USER | | Should be fairly self explanatory. | | CLICKHOUSE_PASSWORD | | Should be fairly self explanatory. | | CLICKHOUSE_DATABASE | | Should be fairly self explanatory. | | HOOK_APPLIANCE | creatia.webhook.appliance | This is used to communicate any webhook messages regarding appliances to a given Slack endpoint. | | HOOK_STANDARD | creatia.webhook.standard | This is the standard webhook that should be used in general, and act as a fallback for all other channels. | | HOOK_GOLIATH | creatia.webhook.goliath | Used to communicate any mitigation related messaging. | | HOOK_MERCURY | creatia.webhook.mercury | Used to communicate any Mercury related messaging. | | HOOK_NOC_METRO | creatia.webhook.noc.backhaul_metro | Used to communicate any changes related to the rates for metro backhaul. | | HOOK_NOC_SUBSEA | creatia.webhook.noc.backhaul_subsea | Used to relay any rate changes for subsea backhaul. | | HOOK_NOC_TERRESTRIAL | creatia.webhook.noc.terrestrial | Used to relay any rate changes for terrestrial backhaul. | | WHITELIST_WHMCS | creatia.whitelist.whmcs | Used to determine the endpoints we can expect WHMCS related requests to come from. Consider refactoring and replacing with the API token system. | | ENDPOINT_APERMON | | Probably deprecated. | | ENDPOINT_WHOIS | creatia.endpoint.whois_forward | A list of endpoints that can be hit with WHO-IS API microservice queries. Should be multiple under the assumption that a given endpoint can end up blocked. | | ENDPOINT_ACL_FORWARD | creatia.endpoint.acl_forward | Deprecated at this point. | | ENDPOINT_PREFIX | creatia.endpoint.prefix_server | Soon to be phased out, an endpoint that let's us query prefix lists for both V4, V6, and detailed V4. Will be phased out in favour of ENDPOINT_ROUTES | | ENDPOINT_ROUTES | creatia.endpoint.route_server | Currently allows full querying of V4 detailed lists. In the future allows querying for V6. Will replace ENDPOINT_PREFIX. | | FRONTEND_MAIN | | creatia.frontend.main | The main / index endpoint for the frontend of Creatia. Used for issuing redirects, or having links in messaging. | | FRONTEND_ASN_APPROVE | | The slug to be attached to the URI to allow ASN approvals. | | FRONTEND_ACC_VERIFY | | The slug to be attached to the URI to allow account verification via a link. | | FRONTEND_ACC_RESET | | The slug to be attached to the URI to allow account password resets via a link. | | ENDPOINT_BGP_FORWARD | | The endpoint for the microservice / forwarder that executes commands on the Arista's, including reroutes, pings, etc. | | SECRET_BGP_FORWARD | | The secret used to identify Creatia to the microservice / forwarder. | ENDPOINT_MERCURY_FORWARD | | The endpoint for the microservice / forwarder that executes Mercury related commands on the Arista's including the BGP configurations. | reporting_clickhouse_db | | The clickhouse database name for reporting. | | reporting_clickhouse_ip | | The clickhouse database endpoint for reporting. | | reporting_clickhouse_port | | The clickhouse database port for reporting. | | reporting_clickhouse_user | | The clickhouse database user for reporting. | | reporting_clickhouse_password | | The clickhouse password for reporting. | | microservice_reporting_url | | The microservice for reporting's endpoint - We do this so we can minimise latency for sequential queries and processing - It's a lot easier to query closer to source. So we effectively get lower latency overall. | | microservice_reporting_password | | Password for the above | | webhook_key | | This is the encryption key used for all webhook endpoints so we don't store raw links in the database - Not a massive risk, but most people who find an arbitrary dump exploit can't necessarily also get our keys - They'd need box access. They'd also funnily enough need to understand Creatia's architecture. | | ENDPOINT_BILLING_MICROSERVICE_URL | | The microservice that generates a list of billing information for validation and display purposes. Must include port and scheme. | | ENDPOINT_BILLING_MICROSERVICE_SECRET | | The secret for the billing microservice. | | ENDPOINT_OVERAGE_MICROSERVICE_URL | | The microservice URL that is used to generate overages for customers and place them into WHMCS invoices. Should include port and scheme. | | bgp_microservice | | The microservice used to provision customer BGP sessions upon routers. Should be it's URL including port and scheme. | compute_microservice_user | | The user for the dedicated server BGP provisioning microservice. | | compute_microservice_password | | The password for the dedicated server BGP provisioning microservice. | | compute_microservice_url | | The microservice for provisioning BGP sessions for dedicated server customers. Should be the URL including port and scheme. | tunnel_microservice_url | | The microservice URL for provisioning GRE tunnels | tunnel_microservice_key | | The microservice key for provisioning GRE tunnels | REVERB_APP_ID | | A unique identity for the websocket server. | REVERB_APP_KEY | | A unique key for the websocket server that identifies the application itself. | REVERB_APP_SECRET | | A unique secret key for the websocket server. | REVERB_SERVER_HOST | | The host that the websocket server is on. | REVERB_SERVER_PORT | | The port that the websocket server is listening on. | REVERB_HOST | | The host for the websocket server again, same as above. | REVERB_PORT | | As above. | REVERB_SCHEME | | Whether we're using HTTP or HTTPS for our websocket server. | REVERB_MAX_REQUEST_SIZE | | Maximum size allowed for requests for the websocket server. Keep in mind that an overly large obsfucated message could blow past this.   With all of this in mind, a minimal environment file for an enterprise customer should look something like: ``` APP_NAME='Creatia Enterprise Build V0.1-POC' APP_ENV=production APP_KEY=base64:we98hdsioh2308eacisoaiosoadioas/ewiw90 APP_DEBUG=false APP_URL=https://enterprise-creatia.securelayer.com APP_ENTERPRISE=1 LOG_CHANNEL=stack LOG_DEPRECATIONS_CHANNEL=null LOG_LEVEL=debug DB_CONNECTION=pgsql DB_HOST=127.0.0.1 DB_PORT=5432 DB_DATABASE=creatia DB_USERNAME=creatia DB_PASSWORD=PASSWORD_HERE CACHE_DRIVER=redis REDIS_HOST=127.0.0.1 REDIS_PASSWORD=PASSWORD_HERE REDIS_PORT=6379 FILESYSTEM_DRIVER=local QUEUE_CONNECTION=database SESSION_DRIVER=file SESSION_LIFETIME=120 MAIL_MAILER=smtp MAIL_HOST=smtp.sendgrid.net MAIL_PORT=465 MAIL_USERNAME=USER_HERE MAIL_PASSWORD=PASSWORD_HERE MAIL_ENCRYPTION=ssl MAIL_FROM_NAME=Creatia MAIL_FROM_ADDRESS=creatia@securelayer.com JWT_SECRET=RANDOM_SECRET_KEY DEVELOPMENT_EMAIL_REDIRECT=jessec@globalsecurelayer.com CHUNK_SIZE=10000 HOOK_APPLIANCE=SLACK_ENDPOINT HOOK_STANDARD=SLACK_ENDPOINT HOOK_GOLIATH=SLACK_ENDPOINT ENDPOINT_WHOIS='206.148.22.181:420,206.148.22.179:420,206.148.22.187:420,206.148.22.177:420' ENDPOINT_PREFIX=ENDPOINT_SERVER_NO_SCHEME_OR_PORT ENDPOINT_ROUTES=ENDPOINT_SERVER_NO_SCHEME FRONTEND_MAIN='https://enterprise-creatia.securelayer.com' FRONTEND_ASN_APPROVE='asn' FRONTEND_ACC_VERIFY='setup' FRONTEND_ACC_RESET='reset' reporting_clickhouse_db=creatia_reporting reporting_clickhouse_ip=SERVER_ENDPOINT reporting_clickhouse_port=8123 reporting_clickhouse_user=USER_HERE reporting_clickhouse_password=PASSWORD_HERE microservice_reporting_url=ENDPOINT_HERE_NO_SCHEME_BUT_HAVE_PORT microservice_reporting_password=PASSWORD_HERE webhook_key=RANDOM_STRING ```   # Configuration Mapping & Hidden Variables *Last verified against the codebase: 2026-07-20.* The table above is the catalogue you'll usually want - This section is the mapping underneath it: which `config()` key each variable actually feeds, the variables that never made it into that table, and the places where the two disagree. When you touch config, check it against `config/` and bump the date. ## How configuration resolves (read this first) We read settings two ways, and the difference genuinely matters in operation: 1. **Through `config()`** - The normal Laravel path. `.env` → a `config/*.php` file → `config('creatia.reporting.host')`. This one is cache-safe, as `php artisan config:cache` bakes it in. 2. **Through raw `env()` at runtime** - A fair few of our own switches and microservice credentials are read with `env('...')` straight in controllers and commands, *not* through `config()`. **These return `null` the moment `config:cache` is active** - Caching bypasses `.env` loading entirely. We don't appear to cache config in production today, so it works - But the day anyone runs `config:cache`, every raw-`env()` switch (the reporting kill-switches, the config-neuter flag, all the microservice URLs and keys) silently goes dark. This is the single most important operational gotcha in the whole environment, so it's worth internalising - The automation docs carry the same warning for the schedulers. Our own settings live under the `creatia.*` namespace in `config/creatia.php` - The rest are stock Laravel config files. ## `config('creatia.*')` map (from `config/creatia.php`) | Config key | Env var(s) | Default | Consumed by | | - | - | - | - | | `creatia.radb.{endpoint,username,password,crypt}` | `RADB_ENDPOINT`, `RADB_USERNAME`, `RADB_PASSWORD`, `RADB_CRYPT` | null | `mercury:radb`, `RADb` helper | | `creatia.clickhouse.{endpoint,port,user,password,database}` | `CLICKHOUSE_ENDPOINT`, `CLICKHOUSE_PORT`, `CLICKHOUSE_USER`, `CLICKHOUSE_PASSWORD`, `CLICKHOUSE_DATABASE` | null | Telemetry ClickHouse (`ClickhouseHandler` native mode, weathermap, `location:update`) | | `creatia.webhook.standard` | `HOOK_STANDARD` | null | Fallback Slack webhook everywhere (`Security`/Bouncer/Whitelist/Whmcs, generic `notify()`) | | `creatia.webhook.goliath` | `HOOK_GOLIATH` | falls back to `HOOK_STANDARD` | Mitigation messaging, alert-acknowledgement | | `creatia.webhook.mercury` | `HOOK_MERCURY` | → `HOOK_STANDARD` | Mercury messaging | | `creatia.webhook.appliance` | `HOOK_APPLIANCE` | → `HOOK_STANDARD` | `goliath:monitor-agent`, `utility:system-health-check` | | `creatia.webhook.noc.{backhaul_metro,backhaul_subsea,backhaul_terrestrial}` | `HOOK_NOC_METRO`, `HOOK_NOC_SUBSEA`, `HOOK_NOC_TERRESTRIAL` | → `HOOK_STANDARD` | NOC rate-change notifications | | `creatia.whmcs.secret` | `WHMCS_SECRET` | `''` | `Whmcs` middleware HMAC integrity check | | `creatia.frontend.{main,uri_asn_approve,uri_account_verify,uri_account_reset}` | `FRONTEND_MAIN`, `FRONTEND_ASN_APPROVE`, `FRONTEND_ACC_VERIFY`, `FRONTEND_ACC_RESET` | `''` | Link/redirect building in mail & approvals | | `creatia.endpoint.whois_forward` | `ENDPOINT_WHOIS` (comma-split) | `10.50.1.91:52020` | WHOIS-forward microservice pool | | `creatia.endpoint.acl_forward` | `ENDPOINT_ACL` (comma-split) | `''` | Deprecated ACL forward | | `creatia.endpoint.prefix_server` | `ENDPOINT_PREFIX` | `''` | Legacy prefix lists (being phased out) | | `creatia.endpoint.route_server` | `ENDPOINT_ROUTES` | `10.50.1.197:10102` | Route-server microservice (all BGP route cache) | | `creatia.endpoint.bgp_forward` | `ENDPOINT_BGP_FORWARD` | `''` | BGP-forward microservice (drives Aristas; `arista:unroute`) | | `creatia.endpoint.goliath` | `ENDPOINT_GOLIATH` (comma-split) | `mia,lax,chi,ash` | Goliath region list (**not in the table above**) | | `creatia.constant.{chunk_small,chunk_medium,chunk_large}` | `CHUNK_SM`, `CHUNK_MD`, `CHUNK_LG` | 1000 / 5000 / 10000 | Automation batch sizes (**note: NOT `CHUNK_SIZE`** — see discrepancies) | | `creatia.whitelist.apermon` | `WHITELIST_APERMON` (comma-split) | `''` | `whitelist:apermon` middleware (likely deprecated) | | `creatia.whitelist.whmcs` | `WHITELIST_WHMCS` (comma-split) | `''` | `Whmcs` + `whitelist:whmcs` middleware | | `creatia.secret.bgp_forward` | `SECRET_BGP_FORWARD` | null | HMAC key for BGP-forward requests | | `creatia.reporting.db/host/port/user/pass` | `reporting_clickhouse_db`, `reporting_clickhouse_ip`, `reporting_clickhouse_port`, `reporting_clickhouse_user`, `reporting_clickhouse_password` | `''` | Reporting ClickHouse (separate from telemetry CH) | | `creatia.reporting.encryption_key` | `webhook_key` | - | `SymEncrypt` for stored webhook URLs (`hook:report-send`) | | `creatia.reporting.microservice_url` | `microservice_reporting_url` | - | Reporting microservice (attack/enrich/list/report) | | `creatia.reporting.microservice_password` | `microservice_reporting_password` | - | Basic-auth password for the above | | `creatia.automation.main_organisation_name` | `AUTOMATION_MAIN_ORGANISATION_NAME` | `Global Secure Layer` | `asn:import` (house org resolution) — **not in the table above** | | `creatia.automation.main_organisation_asn` | `AUTOMATION_MAIN_ASN` | `137409` | House ASN — **not in the table above** | | `creatia.automation.main_organisation_asns` | `AUTOMATION_MAIN_ASNS` (comma-split) | `137409,136510,7578` | House ASN set — **not in the table above** | | `creatia.mock.http` | `CREATIA_MOCK_HTTP` | false | Test-only HTTP mocking — **not in the table above** | ## `config('security.*')` map (from `config/security.php`) | Config key | Env var | Default | Consumed by | | - | - | - | - | | `security.client_login_attempts` | `CLIENT_LOGIN_ATTEMPTS` | 10 | Per-IP login rate limit (`AuthController::login`) — a full two-leg MFA login costs two attempts | | `security.account_login_attempts` | `ACCOUNT_LOGIN_ATTEMPTS` | 10 | Per-account lockout threshold | | `security.account_lockout_time` | `ACCOUNT_LOCKOUT_TIME` | 5 (minutes) | Lockout window | | `security.mfa_bypass_blocks` | `MFA_BYPASS_BLOCKS` (comma-split) | `''` | CIDR blocks whose logins skip the TOTP challenge (`Security::mfa_bypassed()`) — keep to internal/VPN ranges, public CIDRs here are header-spoofable | | `security.mfa_totp_window` | `MFA_TOTP_WINDOW` | 1 | 30s steps of TOTP clock drift tolerated (login + `MfaController`) | | `security.mfa_encryption_secret` | `MFA_ENCRYPTION_SECRET` | null (**required for MFA**) | Plain-text passphrase the TOTP at-rest key is derived from (PBKDF2-SHA256 in `App\Casts\MfaEncrypted`) — deliberately not `APP_KEY`. Use a long memorable phrase; changing it (or the cast's salt/iterations) invalidates every enrollment | | `security.gsl_asn` | `GSL_ASN` | null | GSL-specific ASN | | `security.group_admin_id` … `group_manager_id` | `GROUP_ADMIN_ID` (=1), `GROUP_ORGANISATION_MANAGER_ID` (=2), `GROUP_ORGANISATION_USER_ID` (=3), `GROUP_USER_ID` (=4), `GROUP_MANAGER_ID` (=5) | as shown | Seed-time RBAC group ids (see auth docs) | | `security.development_email_direct` | `DEVELOPMENT_EMAIL_REDIRECT` | `''` | Dev email redirect | | `security.obsfucation.{websockets,responses,salt,noise,passes,flip}` | `OBSFUCATION_WEBSOCKETS`, `OBSFUCATION_RESPONSES`, `OBSFUCATION_SALT`, `OBSFUCATION_NOISE` (8), `OBSFUCATION_PASSES` (1), `OBSFUCATION_FLIP` | mostly false/off | `SymObsfucate` payload obfuscation (off by default) | Auth token lifetime is `config('sanctum.expiration')` = **4320 minutes (hardcoded in `config/sanctum.php`, not env-driven)**. `config/auth.php` fixes the guard to Sanctum (`api` → `sanctum`). ## Hidden / undocumented environment variables (raw `env()` in code) These are read directly with `env()` and are **absent from the catalogue table above**. All are subject to the `config:cache` caveat. | Env var | Where used | Purpose | | - | - | - | | `reporting_disabled` | `group:attack-collection`, `group:attack-notification`, `report:cache-destination-table`, `report:cache-destination-report`, `report-attack:enrich`, `report-attack:carpet-enrich` | Master kill-switch for the reporting/notification pipeline | | `reporting_cache_report_disabled` | `report:cache-destination-report` | Dedicated kill-switch for the PDF pre-warmer | | `goliath_configuration_neuter` | `goliath:store-config` | Restrict config generation to a single region tag (debug/safety) | | `microservice_reporting_2_url` | `report-attack:enrich-thread` | **Second** reporting microservice instance (singular enrich POSTs here) | | `tunnel_microservice_url` / `tunnel_microservice_key` | `TunnelController`, `Organisation/AdminApiController`, `broadcast:mercury-rates` | Mercury GRE-tunnel microservice (`X-API-Key`) | | `compute_microservice_url` / `compute_microservice_user` / `compute_microservice_password` | `ComputeController` | Dedicated-server BGP provisioning microservice | | `bgp_microservice` | `BgpController` | Customer BGP-session provisioning microservice | | `ENDPOINT_BILLING_MICROSERVICE_URL` / `ENDPOINT_BILLING_MICROSERVICE_SECRET` | `Billing/*`, `AdminBgpController` | Billing/commit lookup microservice (WHMCS data) | | `ENDPOINT_OVERAGE_MICROSERVICE_URL` | `OverageRepository`, `billing:generate-invoices` | Overage-generation microservice (writes WHMCS invoices) | | `ENDPOINT_MERCURY_FORWARD` | (documented in table; forwarder for Mercury Arista config) | Mercury forwarder | | `RANDOM_SHA` | `NetworkController` | Lorenzo's port-names automation auth (flagged for removal in the table above) | | `SLACK_HOOK` | `AgentGoliathController` | A **stray** direct Slack webhook read — inconsistent with the `creatia.webhook.*` config pattern; should be migrated to `HOOK_*` | | `APP_ENV` | `BaseCommand`, `ReportRepository` | Environment branching (dev vs prod behaviour) | The Python binaries under `app/Bin` (`GoliathRibUpdate.py`, `GoliathRibAudit.py`) read `DB_HOST/DB_DATABASE/DB_USERNAME/DB_PASSWORD/DB_PORT` from their own `.env` load — they connect to Postgres directly via psycopg2, independent of Laravel's config. ## Stock Laravel variables worth noting - **Two ClickHouse configs exist.** `config('creatia.clickhouse.*')` (telemetry, from `CLICKHOUSE_DATABASE`) and `database.connections.clickhouse` (from **`CLICKHOUSE_DB`** — a *different* env key for the DB name). Reporting ClickHouse is a third, separate config (`reporting_clickhouse_*`). Don't assume one ClickHouse. - **Websockets** are Laravel Reverb (`config/reverb.php`, `BROADCAST_DRIVER`), driven by the full `REVERB_*` family (the table above lists the core ones; Reverb also honours many `REVERB_APP_*` tuning vars and a `REVERB_SCALING_*` Redis-scaling block). `PUSHER_*`/`ABLY_*` in `broadcasting.php` are stock and unused. - **Redis** uses two logical databases: `default` (`REDIS_DB`, 0) and `cache` (`REDIS_CACHE_DB`, 1). Reverb scaling can use its own Redis connection too. - **AWS** vars feed three things: S3 filesystem (`AWS_BUCKET` etc.), SES mail (`services.ses`), and CloudFront invalidation (`config/cloudfront.php`, `AWS_CLOUDFRONT_DISTRIBUTION_ID`) — used by `geoip:export`. - **Queue** is `QUEUE_CONNECTION` (the enterprise sample uses `database`); the worker runs as `creatia-fast-dispatch.service`. ## Discrepancies & things to fix - **`CHUNK_SIZE` is stale.** The catalogue table and the enterprise sample `.env` list `CHUNK_SIZE`, but the code reads `CHUNK_SM` / `CHUNK_MD` / `CHUNK_LG` (via `creatia.constant.*`). Setting `CHUNK_SIZE` does nothing; the three real knobs default to 1000/5000/10000. - **`JWT_SECRET` is a relic.** It appears in the table and the sample `.env`, but auth is Laravel Sanctum, not JWT (see `Docs/Authentication Documentation.md`). Nothing in the request path consumes it. Safe to remove once you've confirmed no external tooling references it. - **`CLICKHOUSE_DATABASE` vs `CLICKHOUSE_DB`.** The telemetry config reads `CLICKHOUSE_DATABASE`; the `database.php` clickhouse connection reads `CLICKHOUSE_DB`. If you only set one, one of the two consumers gets a null DB name. Standardise these. - **`SLACK_HOOK` bypasses the webhook config.** `AgentGoliathController` reads `env('SLACK_HOOK')` directly instead of `config('creatia.webhook.*')`. Fold it into the `HOOK_*` scheme to keep webhook routing in one place. - **Raw-`env()` switches break under `config:cache`** (repeated because it matters): `reporting_disabled`, `reporting_cache_report_disabled`, `goliath_configuration_neuter`, and every `*_microservice*` credential are read outside `config()`. Either migrate them into `config/creatia.php` or never run `config:cache` — pick one and write it down.